exp is not mandated in request objects

[jogu]

VP doesn't say anything about exp in request objects.

JAR also doesn't say anything, meaning we inherit the default behaviour from the JWT RFC, namely that exp is entirely optional (but wallets must respect it if it's there).

Maybe we want to say exp is required. Not sure if we want to say anything about iat / nbf too but they're in the same situation of being entirely optional for verifiers to use.